CVE-2026-45504: Exchange SSRF Leading to Local File Read

CVE-2026-45504 is a high-severity (CVSS 8.8) server-side request forgery (SSRF) vulnerability affecting Microsoft Exchange Server 2016, 2019, and Subscription Edition. While officially classified as requiring authentication, technical research by HawkTrace reveals that the flaw allows attackers to steer Exchange's WOPI-related preview logic into reading local files from the server's filesystem. This is achieved through a missing scheme validation error when the server processes URLs returned from an attacker-controlled endpoint.

Technically, the vulnerability involves an authorized user creating an EWS ReferenceAttachment with a malicious ProviderEndpointUrl. When Exchange attempts to process this attachment, it communicates with the attacker's server, which responds with an unsafe 'file://' scheme URL. Because Exchange fails to validate this scheme, it may open and return the contents of local system files, configuration files, or sensitive secrets readable by the Exchange process.

This vulnerability is critical for organizations with internet-facing Exchange servers, as 'low privilege' authentication is often easily obtained via phished credentials or legacy service accounts. Failure to patch can lead to sensitive data exposure, reconnaissance of internal infrastructure, and potential credential theft through configuration file leakage.